<div dir="ltr"><div><div>>The IPsec endpoint<br>
>does not know whether the packet has to go through the tunnel or to<br>
>the network behind the gateway.<br><br></div>OK. but if the IPSec endpoint specifically tells that go through the tunnel by route configuration ? should it work. in my case this also is not working and same problem as i described before.<br><br></div><div>(eg. in my case on EP-A 20.0.0.2 is tunnel remote endpoint, and route configured as to reach 45.45.45.1 it should take the tunnel instead of default gateway)<br></div><div><br></div>Traffic endpoints are 35.35.35.1 (at Host X) --- 45.45.45.1 (at Host Y)<br><div><br>Route and IPSec Policy on EP-A<br># ip r s<br>35.35.35.1 via 10.0.0.2 dev eth2 proto gated <br>45.45.45.1 via 20.0.0.2 dev eth3 proto gated <br><a href="http://10.43.4.128/26">10.43.4.128/26</a> dev eth1 proto kernel scope link src 10.43.4.166 <br><a href="http://10.0.0.0/24">10.0.0.0/24</a> dev eth2 proto kernel scope link src 10.0.0.1 <br><a href="http://20.0.0.0/24">20.0.0.0/24</a> dev eth3 proto kernel scope link src 20.0.0.1 <br>default via 10.43.4.129 dev eth1 proto gated <br><br><br><br># ip xfrm policy <br>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> proto icmp <br> dir fwd priority 3002 <br> tmpl src 20.0.0.2 dst 20.0.0.1<br> proto esp reqid 0 mode tunnel<br>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> proto icmp <br> dir in priority 3002 <br> tmpl src 20.0.0.2 dst 20.0.0.1<br> proto esp reqid 16385 mode tunnel<br>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> proto icmp <br> dir out priority 3002 <br> tmpl src 20.0.0.1 dst 20.0.0.2<br> proto esp reqid 16384 mode tunnel<br><br></div><div>Thanks !<br></div><div><br>Best regards,<br></div><div>Deepak<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 9, 2015 at 12:59 AM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Deepak,<br>
<br>
defining a traffic selector of <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> on both sides of the tunnel<br>
does not work since this causes routing problems. The IPsec endpoint<br>
does not know whether the packet has to go through the tunnel or to<br>
the network behind the gateway.<br>
<br>
Best regards<br>
<br>
Andreas<br>
<span class=""><br>
On 03/08/2015 07:13 PM, Deepak Khandelwal wrote:<br>
> Hi,<br>
><br>
> i have a IPSec Tunnel in forwarding setup as below.<br>
><br>
> Host X ---plain packets--- EP-A ---ipsec tunnel----EP-B ---plain<br>
> packet--- HOST Y<br>
><br>
> Host X and Host Y communicate to each other (eg. ping) with 2 next hops<br>
> in between EP-A and EP-B.<br>
> IPSec Tunnel is setup b/w EP-A and EP-B to encrypt all Traffic<br>
</span>> (<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>>)<br>
<span class="">><br>
> i could see the traffic from X reach to EP-A, but from there it is not<br>
> able to forward packets to EP-B via tunnel.<br>
> There are XfrmInTmplMismatch error counters increasing.<br>
><br>
> After debugging, it looks that the plain packet (skb->sp = NULL)<br>
> which reach to EP-A, trying to match either with "in" or "fwd" template<br>
> in __xfrm_policy_check. this checks fails and packets getting dropped<br>
> with XfrmInTmplMismatch error counters increasing.<br>
><br>
> in short if plain incoming packets, matches to "fwd" or "in" policy this<br>
> error counter increase and packets get drop.<br>
><br>
> Is this a expected behavior ? or there any bug in kernel (xfrm) ?<br>
><br>
> # ip xfrm policy<br>
</span>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> proto<br>
<span class="">> icmp<br>
> dir fwd priority 3002<br>
> tmpl src 20.0.0.2 dst 20.0.0.1<br>
> proto esp reqid 0 mode tunnel<br>
</span>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> proto<br>
<span class="">> icmp<br>
> dir in priority 3002<br>
> tmpl src 20.0.0.2 dst 20.0.0.1<br>
> proto esp reqid 16385 mode tunnel<br>
</span>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> proto<br>
<span class="">> icmp<br>
> dir out priority 3002<br>
> tmpl src 20.0.0.1 dst 20.0.0.2<br>
> proto esp reqid 16384 mode tunnel<br>
><br>
><br>
> P.S. without ipsec traffic flows fine so there is no route issue.<br>
><br>
><br>
> Thanks !<br>
><br>
> Best Regards,<br>
> Deepak<br>
><br>
><br>
><br>
</span>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">Thanks <br>With Regards<br>Deepak Khandelwal<br>91-9461072891</div>
</div>